From 50a744656fe81774c1cfb6d2b765de2a93db5478 Mon Sep 17 00:00:00 2001 From: twentyOne2x Date: Tue, 7 Jul 2026 13:58:37 +0200 Subject: [PATCH] Use dedicated GCP readiness service account (#53) --- .github/workflows/gcp-readiness.yml | 4 ++-- docs/gcp-infra-hardening-20260707.md | 8 ++++---- tests/test_gcp_readiness_workflow.py | 2 ++ 3 files changed, 8 insertions(+), 6 deletions(-) diff --git a/.github/workflows/gcp-readiness.yml b/.github/workflows/gcp-readiness.yml index a299983..5e4eb3b 100644 --- a/.github/workflows/gcp-readiness.yml +++ b/.github/workflows/gcp-readiness.yml @@ -6,7 +6,7 @@ on: service_account: description: GCP service account to impersonate for the read-only readiness probe required: false - default: sa-artifact-builder@teleo-501523.iam.gserviceaccount.com + default: sa-teleo-readiness@teleo-501523.iam.gserviceaccount.com permissions: contents: read @@ -19,7 +19,7 @@ concurrency: env: PROJECT_ID: teleo-501523 WORKLOAD_IDENTITY_PROVIDER: projects/785938879453/locations/global/workloadIdentityPools/github-actions/providers/living-ip-github - READINESS_SERVICE_ACCOUNT: ${{ inputs.service_account || 'sa-artifact-builder@teleo-501523.iam.gserviceaccount.com' }} + READINESS_SERVICE_ACCOUNT: ${{ inputs.service_account || 'sa-teleo-readiness@teleo-501523.iam.gserviceaccount.com' }} READINESS_ARTIFACT_DIR: gcp-readiness-artifacts jobs: diff --git a/docs/gcp-infra-hardening-20260707.md b/docs/gcp-infra-hardening-20260707.md index f18df2a..353eabb 100644 --- a/docs/gcp-infra-hardening-20260707.md +++ b/docs/gcp-infra-hardening-20260707.md @@ -69,11 +69,11 @@ gh workflow run gcp-readiness.yml --repo living-ip/teleo-infrastructure --ref ma This workflow runs `ops/check_gcp_infra_readiness.py` from GitHub Actions and uploads stdout, stderr, exit code, and a summary as the `gcp-readiness` artifact. -It is intentionally non-mutating. If the Artifact Registry service account lacks -broader read permissions, the artifact is still the proof of the exact IAM gap. +It is intentionally non-mutating and defaults to +`sa-teleo-readiness@teleo-501523.iam.gserviceaccount.com`. -After applying the dedicated readiness service account from the IAM split plan, -run the same workflow against that account: +If you need to test a specific service account during IAM repair, pass it +explicitly: ```bash gh workflow run gcp-readiness.yml \ diff --git a/tests/test_gcp_readiness_workflow.py b/tests/test_gcp_readiness_workflow.py index 57772f4..30c9c33 100644 --- a/tests/test_gcp_readiness_workflow.py +++ b/tests/test_gcp_readiness_workflow.py @@ -6,6 +6,8 @@ def test_gcp_readiness_workflow_uses_uploadable_artifact_dir() -> None: assert "service_account:" in workflow assert "READINESS_SERVICE_ACCOUNT:" in workflow + assert "sa-teleo-readiness@teleo-501523.iam.gserviceaccount.com" in workflow + assert "sa-artifact-builder@teleo-501523.iam.gserviceaccount.com" not in workflow assert "READINESS_ARTIFACT_DIR: gcp-readiness-artifacts" in workflow assert 'mkdir -p "${READINESS_ARTIFACT_DIR}"' in workflow assert "path: ${{ env.READINESS_ARTIFACT_DIR }}/" in workflow